HackTheBox
Medium
Aug 10, 2026
•
10 min read
TombWatcher - HackTheBox
A full walkthrough of TombWatcher (HTB) from a targeted Kerberoast all the way to Domain Admin via a chained ESC15 → ESC3 ADCS exploit, with a deleted-object restoration twist in the middle.
#ADCS
#Active Directory
#BloodHound
#Certificate Abuse
#ESC15
Read more